arXiv subjects

Zhicheng Chen

Publications and source records attributed to Zhicheng Chen.

At least 19 recordsLinked to original sources

arXiv2026

FuzzingBrain-Bench V1: Evaluating Open-Ended Bug Discovery by LLMs

Evaluating the ability of large language models (LLMs) to discover software bugs is increasingly important. Existing benchmarks typically evaluate this capability by asking the model to generate a proof-of-concept input that triggers a predefined target vulnerability. However, this setup may overlook valid crashes discovered by the model when they do not match the predefined target. As a result, the evaluation may not reflect the model's real capability. We present FuzzingBrain-Bench, a benchmark for assessing AI models' ability to discover bugs in open-source software. Models are given an open-source project and a sanitizer-instrumented harness in a self-contained Docker image. Their goal is to generate inputs that trigger as many distinct crashes as possible through the harness. A model's performance on each challenge is scored based on the number of distinct crash signatures it produces, capped at a predefined maximum and weighted by a difficulty coefficient. FuzzingBrain-Bench V1 consists of 77 challenges drawn from 43 open-source projects, with 36 C, 32 C++, and 9 Java/JVM challenges. We evaluate Claude Haiku 4.5, Claude Sonnet 4.6, and Claude Opus 4.8 on the full benchmark. Claude Opus 4.8 performs best, triggering crashes in 60 of 77 challenges and achieving a score of 196 out of 579. None of the three models triggers a crash in 13 challenges. The FuzzingBrain-Bench corpus and harnesses are publicly available at https://github.com/fuzzingbrain/FuzzingBrain-Bench.

cs.AI↗

arXiv2026

Entropy-based Code Adversarial Translation for Real-world Repository Migration

LLMs have demonstrated strong capabilities in code generation and automated program repair, but migrating an entire repository rarely produces a runnable application because long-horizon translation challenges LLM-based agents' ability to maintain repository-level migration objectives. In this work, we propose Entropy-based Code Adversarial Translation (ECAT), a multi-agent framework for automated Android-to-HarmonyOS repository migration. ECAT formulates repository migration as adversarial entropy minimization through a generator-discriminator architecture. The discriminator measures migration quality using a unified metric called Code Entropy and produces text gradients that specify both file-level generation directives and the skills needed to execute them. Guided by these optimization signals, the generator iteratively updates the repository, and each update is accepted only if it reduces Code Entropy. Repeated generator--discriminator interactions progressively drive the migration from an initial template toward a functionally complete HarmonyOS repository. Successful low-entropy trajectories are further distilled into a self-evolving memory tree, enabling transferable migration knowledge across repositories. We also introduce A2H-RepoBench, the first real-world benchmark for Android-to-HarmonyOS repository migration, covering applications from tens of thousands to hundreds of thousands of lines of code. Evaluated by node alignment and an agent-based functional judge, ECAT achieves 74.7% overall migration quality and consistently outperforms existing agent-based methods across repositories of different scales.

cs.AI↗

arXiv2026

Fundamental Propositional Logic with Preconditional: Strong Completeness, Finite Model Property, and Modal Translations

Fundamental logic (Holliday 2023) is a non-classical logic based only on the introduction and elimination rules for conjunction, disjunction, and negation in a Fitch-style natural deduction system, while a preconditional (Holliday 2025) is a binary operation on a bounded lattice satisfying five natural axioms and subsuming Heyting implication, the Sasaki hook on ortholattices, and Lewis-Stalnaker-style conditionals satisfying flattening. We combine the two by giving a consequence-relation presentation $\mathsf{K}$ whose algebras are exactly Holliday's bounded lattices with a preconditional, and then studying two natural extensions, $\mathsf{T}$ and $\mathsf{F}$, the latter being fundamental propositional logic with a preconditional. For $\mathsf{T}$ and $\mathsf{F}$, we prove strong completeness with respect to a purely relational semantics, using a canonical model whose points are pairs of theories, and establish the finite model property and hence decidability. Finally, following Holliday and Massas (2026), we adapt their GMT- and Goldblatt-style embeddings to fundamental logic with a preconditional. The resulting translations are full and faithful into ortho-$\mathsf{S4}$ and intuitionistic $\mathsf{KTB}$, respectively. The new conditional clauses send the preconditional to a boxed Sasaki hook on the former side and to a strict intuitionistic conditional on the latter whose classical $\mathsf{KTB}$ reading is equivalent to the Goldblatt translation of the Sasaki hook. The frame constructions follow the reduct-and-companion pattern of Holliday and Massas; the essential additional ingredient is the semantic transfer calculation for the preconditional.

math.LO↗

arXiv2026

DNN Koopman-Based Deviation Compensation for UGV Path Tracking Control on Coupled Slope and Potholed Road

Unmanned ground vehicles (UGVs) operating in off-road scenarios are confronted with complex terrain disturbances that can substantially degrade path tracking performance. To address this challenge, this paper proposes a deep neural network (DNN) Koopman-based deviation compensation strategy for UGV path tracking control. Firstly, based on the vehicle dynamic function on coupled slope, an adaptive forgetting recursive least squares method with decoupled error terms is designed to estimate tire cornering stiffness. On this basis, a Laguerre model predictive control (LMPC) path tracking control strategy is designed by incorporating Laguerre functions, which can reduce computational resource usage while maintaining reliable tracking performance across different coupled slope scenarios. Then, by integrating Koopman operator theory with DNN, a DNN Koopman (DK) path deviation compensation method is proposed, which significantly improves the path tracking accuracy of UGV under potholed road disturbances. Furthermore, an event-triggered parallel cooperative (EPC) compensation mechanism that couples LMPC with DK is established based on compensation activation criteria and credibility verification. This mechanism improves path tracking accuracy on potholed road while ensuring the feasibility of overall steering command and stability of vehicle after DK compensation. Finally, a hardware-in-the-loop (HiL) experimental platform is constructed for validation. Experimental results demonstrate that the proposed UGV path tracking strategy improves tracking performance by more than 11.5% across multiple operating conditions.

cs.RO↗

arXiv2026

FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction

Software vulnerabilities pose critical security threats, with nearly 50,000 CVEs reported in 2025. While Large Language Models (LLMs) show promise for automated vulnerability detection, three key challenges remain. First, LLM-generated vulnerability reports suffer from high false positive rates and lack reproducible verification. Second, existing LLM-based approaches use suboptimal granularities for vulnerability localization: function-level analysis overlooks bugs when context becomes extensive, while line-level analysis lacks sufficient context. Third, existing approaches have difficulty reasoning about vulnerabilities with complex cross-function dependencies and triggering conditions. We present FuzzingBrain V2, a multi-agent system that addresses these gaps through four key contributions: (1) fully automated vulnerability analysis built on Google's OSS-Fuzz, ensuring all reported vulnerabilities are fuzzer-reproducible; (2) Suspicious Point, a novel control-flow-based abstraction for precise vulnerability localization at the optimal granularity; (3) logic-driven hierarchical function analysis with dual-layer fuzzing enhancing function coverage under resource constraints; (4) MCP-based static and dynamic analysis tools with context engineering enhancing complex vulnerability reasoning. On the AIxCC 2025 Final Competition C/C++ dataset, FuzzingBrain V2 achieved 90% detection rate (36 of 40 vulnerabilities). In real-world deployment, FuzzingBrain V2 discovered 29 zero-day vulnerabilities across 12 open-source projects, all confirmed and fixed by maintainers, with 2 assigned CVE IDs.

cs.CR↗

arXiv2026

Quality-Assured Fuzz Harness Generation via the Four Principles Framework

Fuzz testing is the dominant technique for finding memory-safety vulnerabilities in C/C++ software, yet its effectiveness hinges on the quality of fuzz harnesses -- the programs that bridge fuzzers and library APIs. A growing body of tools now automate harness generation, but none systematically ensures the correctness of produced harnesses: logic errors, API misuse, and lifecycle violations go undetected at the source level. As LLM-driven generation scales harness creation, uncontrolled quality turns scale into a liability. We present QuartetFuzz, an autonomous harness-generation system that systematically improves correctness throughout the generation process. At its core is the Four Principles framework -- Logic Correctness (P1), API Protocol Compliance (P2), Security Boundary Respect (P3), and Entry Point Adequacy (P4) -- the first source-level definition of harness correctness with mathematical specifications and implementable checks. We operationalize these principles in an autonomous LLM agent that produces harnesses satisfying P1-P4 through a generate-check-fix loop before any fuzzing begins. Deployed on 23 open-source projects spanning C/C++, Java, and JavaScript, the system submits 42 bug reports, of which 29 are fixed or confirmed upstream (including 3 CVEs) and only 2 are rejected (4.8% FP rate). During generation, the built-in P1/P2 checks automatically intercepted 58 harness-induced crashes that would otherwise have been false positives. Applied as a quality auditor to 586 existing production harnesses across 70 projects, the system identifies 53 violations (45 confirmed, 35 fixed). We release a dataset of 100 labeled harnesses for reproducible evaluation. Code and dataset are available at https://github.com/OwenSanzas/QuartetFuzz

cs.CR↗

arXiv2026

MSDformer: Multi-scale Discrete Transformer For Time Series Generation

Discrete Token Modeling (DTM), which employs vector quantization techniques, has demonstrated remarkable success in modeling non-natural language modalities, particularly in time series generation. While our prior work SDformer established the first DTM-based framework to achieve state-of-the-art performance in this domain, two critical limitations persist in existing DTM approaches: 1) their inability to capture multi-scale temporal patterns inherent to complex time series data, and 2) the absence of theoretical foundations to guide model optimization. To address these challenges, we proposes a novel multi-scale DTM-based time series generation method, called Multi-Scale Discrete Transformer (MSDformer). MSDformer employs a multi-scale time series tokenizer to learn discrete token representations at multiple scales, which jointly characterize the complex nature of time series data. Subsequently, MSDformer applies a multi-scale autoregressive token modeling technique to capture the multi-scale patterns of time series within the discrete latent space. Theoretically, we validate the effectiveness of the DTM method and the rationality of MSDformer through the rate-distortion theorem. Comprehensive experiments demonstrate that MSDformer significantly outperforms state-of-the-art methods. Both theoretical analysis and experimental results demonstrate that incorporating multi-scale information and modeling multi-scale patterns can substantially enhance the quality of generated time series in DTM-based approaches. Code is available at this repository:https://github.com/kkking-kk/MSDformer.

cs.LG↗

arXiv2026

A Systematic Study of LLM-Based Architectures for Automated Patching

Large language models (LLMs) have shown promise for automated patching, but their effectiveness depends strongly on how they are integrated into patching systems. While prior work explores prompting strategies and individual agent designs, the field lacks a systematic comparison of patching architectures. In this paper, we present a controlled evaluation of four LLM-based patching paradigms -- fixed workflow, single-agent system, multi-agent system, and general-purpose code agents -- using a unified benchmark and evaluation framework. We analyze patch correctness, failure modes, token usage, and execution time across real-world vulnerability tasks. Our results reveal clear architectural trade-offs: fixed workflows are efficient but brittle, single-agent systems balance flexibility and cost, and multi-agent designs improve generalization at the expense of substantially higher overhead and increased risk of reasoning drift on complex tasks. Surprisingly, general-purpose code agents achieve the strongest overall patching performance, benefiting from general-purpose tool interfaces that support effective adaptation across vulnerability types. Overall, we show that architectural design and iteration depth, rather than model capability alone, dominate the reliability and cost of LLM-based automated patching.

cs.CR↗

arXiv2026

Fundamental Propositional Logic with Strict Implication

Fundamental logic was introduced by Wesley Holliday (2023) to unify intuitionistic logic and quantum logic from a proof-theoretic perspective, capturing the logic determined solely by the introduction and elimination rules of connectives $\neg$, $\wedge$, $\vee$. This paper incorporates strict implication -- standard in intuitionistic logic and a significant candidate for quantum logic -- into the framework of fundamental propositional logic. We demonstrate that, unlike the original language, the presence of strict implication causes the semantic consequence relations over pseudo-reflexive pseudo-symmetric frames and reflexive pseudo-symmetric frames to diverge. Consequently, we provide separate axiomatizations for these two logics in the language $\{\perp, \wedge, \vee, \rightarrow\}$. Soundness and completeness theorems are established for both systems.

math.LO↗

arXiv2026

A warping function-based control chart for detecting distributional changes in damage-sensitive features for structural condition assessment

Data-driven damage detection methods achieve damage identification by analyzing changes in damage-sensitive features (DSFs) derived from structural health monitoring (SHM) data. The core reason for their effectiveness lies in the fact that damage or structural state transition can be manifested as changes in the distribution of DSF data. This enables us to reframe the problem of damage detection as one of identifying these distributional changes. Hence, developing automated tools for detecting such changes is pivotal for automated structural health diagnosis. Control charts are extensively utilized in SHM for DSF change detection, owing to their excellent online detection and early warning capabilities. However, conventional methods are primarily designed to detect mean or variance shifts, making it challenging to identify complex shape changes in distributions. This limitation results in insufficient damage detection sensitivity. Moreover, they typically exhibit poor robustness against data contamination. This paper proposes a novel control chart to address these limitations. It employs the probability density functions (PDFs) of subgrouped DSF data as monitoring objects, with shape deformations characterized by warping functions. Furthermore, a nonparametric control chart is specifically constructed for warping function monitoring in the functional data analysis framework. Key advantages of the new method include the ability to detect both shifts and complex shape deformations in distributions, excellent online detection performance, and robustness against data contamination. Extensive simulation studies demonstrate its superiority over competing approaches. Finally, the method is applied to detecting distributional changes in DSF data for cable condition assessment in a long-span cable-stayed bridge, demonstrating its practical utility in engineering.

stat.AP↗

arXiv2025

Ribbonlength upper bounds for small crossing knots and links

Given a thin strip of paper, tie a knot, connect the ends, and flatten into the plane. This is a physical model of a folded ribbon knot in the plane, first introduced by Louis Kauffman. We study the folded ribbonlength of these folded ribbon knots, which is defined as the knot's length-to-width ratio. The {\em ribbonlength problem} asks to find the infimal folded ribbonlength of a knot or link type. By finding new methods of creating folded ribbon knots, we improve upon existing upper bounds for the folded ribbonlength of $(2,q)$-torus links, twist knots, and pretzel links. These give the best known bounds to date for small crossing knots in these families. For example, there is a folded ribbonlength twist knot $T_n$ with folded ribbonlength $\text{Rib}(T_n) = n +6$. Applying this to the figure-eight knot $T_2$ yields a folded ribbonlength $\text{Rib}(T_2)= 8$, which we conjecture is the infimum.

math.GT↗

arXiv2025

An Intermediate Logic Contained in Medvedev's Logic with Disjunction Property

Let $\textbf{SU}$ be the superintuitionistic logic defined by the axiom $\boldsymbol{su} = ((\neg p\to q)\land(\neg q\to p) \rightarrow r \vee s) \to ( p \rightarrow r) \vee(q \rightarrow s)$, or equivalently, by Andrew's axiom. It is easy to check that $\textbf{SU}$ is contained in Medvedev's logic and contains both Kreisel-Putnam logic and Scott logic. We show that on \textbf{S4} frames, $\boldsymbol{su}$ corresponds to a certain first-order property, called the ``strong union'' property. The strong completeness of \textbf{SU}, with respect to the class of \textbf{S4} frames enjoying this property, is proved. Furthermore, we demonstrate that \textbf{SU} has the disjunction property. As a result, \textbf{SU} stands as the strongest logic currently known below Medvedev's logic that has both an axiomatization and the disjunction property.

math.LO↗

arXiv2025

Self-Introspective Decoding: Alleviating Hallucinations for Large Vision-Language Models

While Large Vision-Language Models (LVLMs) have rapidly advanced in recent years, the prevalent issue known as the `hallucination' problem has emerged as a significant bottleneck, hindering their real-world deployments. Existing methods mitigate this issue mainly from two perspectives: One approach leverages extra knowledge like robust instruction tuning LVLMs with curated datasets or employing auxiliary analysis networks, which inevitable incur additional costs. Another approach, known as contrastive decoding, induces hallucinations by manually disturbing the vision or instruction raw inputs and mitigates them by contrasting the outputs of the disturbed and original LVLMs. However, these approaches rely on empirical holistic input disturbances and double the inference cost. To avoid these issues, we propose a simple yet effective method named Self-Introspective Decoding (SID). Our empirical investigation reveals that pretrained LVLMs can introspectively assess the importance of vision tokens based on preceding vision and text (both instruction and generated) tokens. We develop the Context and Text-aware Token Selection (CT2S) strategy, which preserves only unimportant vision tokens after early layers of LVLMs to adaptively amplify text-informed hallucination during the auto-regressive decoding. This approach ensures that multimodal knowledge absorbed in the early layers induces multimodal contextual rather than aimless hallucinations. Subsequently, the original token logits subtract the amplified vision-and-text association hallucinations, guiding LVLMs decoding faithfully. Extensive experiments illustrate SID generates less-hallucination and higher-quality texts across various metrics, without extra knowledge and much additional computation burdens.

cs.CV↗

arXiv2025

LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights

Large Language Models (LLMs) are emerging as transformative tools for software vulnerability detection, addressing critical challenges in the security domain. Traditional methods, such as static and dynamic analysis, often falter due to inefficiencies, high false positive rates, and the growing complexity of modern software systems. By leveraging their ability to analyze code structures, identify patterns, and generate repair suggestions, LLMs, exemplified by models like GPT, BERT, and CodeBERT, present a novel and scalable approach to mitigating vulnerabilities. This paper provides a detailed survey of LLMs in vulnerability detection. It examines key aspects, including model architectures, application methods, target languages, fine-tuning strategies, datasets, and evaluation metrics. We also analyze the scope of current research problems, highlighting the strengths and weaknesses of existing approaches. Further, we address challenges such as cross-language vulnerability detection, multimodal data integration, and repository-level analysis. Based on these findings, we propose solutions for issues like dataset scalability, model interpretability, and applications in low-resource scenarios. Our contributions are threefold: (1) a systematic review of how LLMs are applied in vulnerability detection; (2) an analysis of shared patterns and differences across studies, with a unified framework for understanding the field; and (3) a summary of key challenges and future research directions. This work provides valuable insights for advancing LLM-based vulnerability detection. We also maintain and regularly update latest selected paper on https://github.com/OwenSanzas/LLM-For-Vulnerability-Detection

cs.CR↗

arXiv2024

The Logics of Individual Medvedev Frames

Let $n$-Medvedev's logic $\mathbf{ML}_n$ be the intuitionistic logic of Medvedev frames based on the non-empty subsets of a set of size $n$, which we call $n$-Medvedev frames. While these are tabular logics, after characterizing $n$-Medvedev frames using the property of having at least $n$ maximal points, we offer a uniform axiomatization of them through a Gabbay-style rule corresponding to this property. Further properties including compactness, disjunction property, and structural completeness of $\mathbf{ML}_n$ are explored and compared to those of Medvedev's logic $\mathbf{ML}$.

math.LO↗

arXiv2024

A unified relational semantics for BPL, IPL and OL -- axiomatization without disjunction

In this paper, we propose a relational semantics of propositional language, which unifies the relational semantics of intuitionistic logic, Visser's Basic Propositional Logic and orthologic. Working in language $\{\bot,\land,\neg\}$ and $\{\bot,\land,\to\}$ respectively, we axiomatize this basic logic as well as stronger ones corresponding to different combinations of frame conditions: reflexivity, symmetry, and transitivity. We also provide translations from these propositional logics into modal logics.

math.LO↗

arXiv2024

MGCP: A Multi-Grained Correlation based Prediction Network for Multivariate Time Series

Multivariate time series prediction is widely used in daily life, which poses significant challenges due to the complex correlations that exist at multi-grained levels. Unfortunately, the majority of current time series prediction models fail to simultaneously learn the correlations of multivariate time series at multi-grained levels, resulting in suboptimal performance. To address this, we propose a Multi-Grained Correlations-based Prediction (MGCP) Network, which simultaneously considers the correlations at three granularity levels to enhance prediction performance. Specifically, MGCP utilizes Adaptive Fourier Neural Operators and Graph Convolutional Networks to learn the global spatiotemporal correlations and inter-series correlations, enabling the extraction of potential features from multivariate time series at fine-grained and medium-grained levels. Additionally, MGCP employs adversarial training with an attention mechanism-based predictor and conditional discriminator to optimize prediction results at coarse-grained level, ensuring high fidelity between the generated forecast results and the actual data distribution. Finally, we compare MGCP with several state-of-the-art time series prediction algorithms on real-world benchmark datasets, and our results demonstrate the generality and effectiveness of the proposed model.

cs.LG↗

arXiv2024

Detecting Multiple Change Points in Distributional Sequences Derived from Structural Health Monitoring Data: An Application to Bridge Damage Detection

Detecting damage in critical structures using monitored data is a fundamental task of structural health monitoring, which is extremely important for maintaining structures' safety and life-cycle management. Based on statistical pattern recognition paradigm, damage detection can be conducted by assessing changes in the distribution of properly extracted damage-sensitive features (DSFs). This can be naturally formulated as a distributional change-point detection problem. A good change-point detector for damage detection should be scalable to large DSF datasets, applicable to different types of changes, and capable of controlling for false-positive indications. This study proposes a new distributional change-point detection method for damage detection to address these challenges. We embed the elements of a DSF distributional sequence into the Wasserstein space and construct a moving sum (MOSUM) multiple change-point detector based on Fréchet statistics and establish theoretical properties. Extensive simulation studies demonstrate the superiority of our proposed approach against other competitors to address the aforementioned practical requirements. We apply our method to the cable-tension measurements monitored from a long-span cable-stayed bridge for cable damage detection. We conduct a comprehensive change-point analysis for the extracted DSF data, and reveal interesting patterns from the detected changes, which provides valuable insights into cable system damage.

stat.ME↗